# Credentials

## Introduction

Credentials are upstream API secrets for **managed** pools. You enter a secret
once. The dashboard never keeps it, not even a hash, and never echoes it back.
The edge encrypts it on save and decrypts it only inside an isolated sandbox to
reach your origin. Attach one credential to any number of managed pools;
rotating it updates every pool that uses it.

Manage credentials under **Credentials** in the dashboard.

## Create a credential

1. Open **Credentials → Add credential**.
2. Name it and choose an auth method (bearer, basic, API key, OAuth 1.0,
   OAuth2 client-credentials, or OAuth2 refresh token).
3. Enter the secret fields and save.

## Attach to a pool

On a managed pool's **Settings**, select the credential. It applies to new
requests within a few seconds.

Pass-through pools do not use credentials. Callers supply upstream auth on
each request.

## OAuth 2.0 refresh token

Use this when the origin issues access tokens from a stored refresh token
instead of a client-credentials grant. Amazon SP-API (Login with Amazon) is
the usual case: one developer app, one refresh token sealed at the edge, many
callers with pool keys.

Set the token URL and the header the access token is attached as. For Amazon
SP-API that is `https://api.amazon.com/auth/o2/token` and
`x-amz-access-token`. The edge exchanges the refresh token, caches the access
token, and attaches it as that header. Callers never see the refresh token
or client secret.

See [Front Amazon SP-API](/docs/knowledge-base/amazon-sp-api).

## Rotate

Rotate from the Credentials page. Pools that reference the credential pick up
the new secret within a few seconds without changing pool keys or client config.

## Next steps

- [Pool settings](/docs/pools/settings)
- [Access](/docs/pools/access)